ClawHub
Back to skill

Security audit

twitterapi-io

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed Twitter/X API skill, but it gives an agent live account-changing, DM, credential, webhook, stream-monitoring, and optional unpinned MCP execution capabilities without strong guardrails.

Review before installing. Treat this as a live Twitter/X account-control skill, not just a search helper. Use read-only API-key operations unless you explicitly need writes; require confirmation before any tweet, DM, follow, profile change, delete, webhook rule, or stream-monitoring change. Do not paste passwords, 2FA secrets, login cookies, proxy credentials, or API keys into prompts or logs. Avoid the unpinned MCP `npx -y` command unless you pin and review the package, and rotate/revoke TwitterAPI.io keys and Twitter sessions if exposed.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Error
Location
SKILL.md:299
Finding

Unpinned Third-Party Package Is Downloaded and Executed Automatically

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:299-304
Vulnerability Type: Unsafe third-party dependency execution
Risk Level: High

Vulnerable code snippet:

bash
## MCP server

claude mcp add twitterapi-io -- npx -y twitterapi-io-mcp

Technical Analysis

The documented command invokes npx with the -y option, which suppresses confirmation and automatically downloads and executes the package resolved under the name twitterapi-io-mcp. No exact package version or integrity digest is specified.

Consequently, the code executed by users is not immutable relative to the audited skill. A future package release, compromised publisher account, registry compromise, or malicious package replacement could cause this command to retrieve and execute code that was not present during the audit. The package executes with the permissions of the user running the command and may inherit the process environment and access locally available files.

This is a supply-chain vulnerability rather than evidence that the package is currently malicious.

Attack Path

  1. An attacker compromises the npm publisher account, package repository, release workflow, or another component capable of publishing a package version.
  2. The attacker publishes a malicious version of twitterapi-io-mcp.
  3. A user follows the skill documentation and runs the unpinned npx -y twitterapi-io-mcp command.
  4. npx resolves and downloads the attacker-controlled version without an interactive approval step.
  5. The malicious package executes with the invoking user's privileges.
  6. The payload can access resources available to that user and process, potentially including API credentials, project files, configuration files, and environment variables.

Impact Assessment

Successful exploitation can result in arbitrary local code execution with the privileges of the invoking user. The accessible scope may include the user's files, d ...[truncated 311 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin the package to an exact reviewed version, for example twitterapi-io-mcp@X.Y.Z, rather than resolving the latest available release.
  • Publish and verify an integrity digest or signed provenance record for the reviewed package artifact.
  • Remove automatic confirmation where practical so users can inspect the package and resolved version before execution.
  • Recommend installation from a lockfile-backed project with integrity metadata instead of ad hoc npx execution.
  • Review the package contents and lifecycle scripts before recommending a new version.
  • Run the MCP process under a dedicated, least-privilege account or sandbox with restricted filesystem, environment, and network access.
  • Document a trusted version-update process so dependency upgrades receive security review before the pinned version changes.

T09 · Insecure Skill Coding Practices

Error
Location
references/read-endpoints.md:180
Finding

Twitter Session Credential Is Transmitted in a URL Query Parameter

Content
View full analysis

Vulnerability Details

File Location: references/read-endpoints.md:180-187
Vulnerability Type: Sensitive session credential exposure through URL logging
Risk Level: High

Vulnerable code snippet:

bash
**Get DM History by User ID** `GET /twitter/get_dm_history_by_user_id`
```bash
curl -s "https://api.twitterapi.io/twitter/get_dm_history_by_user_id?login_cookies=COOKIE&user_id=USERID" \
  -H "X-API-Key: $TWITTERAPI_IO_KEY"

Params: login_cookies (required), user_id (required), proxy (optional but recommended, residential proxy URL) Note: Requires login_cookies from user_login_v2 (unlike most read endpoints). Returns DM conversation history with a specific user. > ⚠️ Security warning: login_cookies is sent as a GET query parameter, meaning it appears in URL logs, browser history, and server access logs. Use HTTPS and avoid logging request URLs when calling this endpoint.

text

### Technical Analysis

The endpoint requires the Twitter login session cookie to be embedded in the query string of a GET request. URLs are routinely retained by shell history, command-line process inspection, HTTP client diagnostics, monitoring systems, reverse proxies, access logs, error reports, and observability platforms.

HTTPS protects the request from passive interception while it is in transit, but it does not prevent the full URL from being recorded by the client, endpoint infrastructure, or authorized intermediaries that terminate TLS. Because `login_cookies` represents an authenticated Twitter session, disclosure may enable session reuse rather than merely revealing non-sensitive request metadata.

The source documentation explicitly acknowledges this exposure, but the provided command still establishes an unsafe credential-handling pattern.

### Attack Path

1. A user replaces the `COOKIE` placeholder with a valid Twitter login cookie and runs the documented command.
2. The complete comman
...[truncated 1340 chars]
Remediation
View remediation

Remediation Suggestions

  • Prefer a revised API endpoint that accepts the session credential in an authorization header or POST body rather than in the URL.
  • Request that the service provider deprecate the GET-query authentication design.
  • Until a safer endpoint exists, avoid using this operation with high-value or primary Twitter accounts.
  • Do not place a literal cookie directly in an interactive shell command. Construct the request through a client that obtains the secret from protected secret storage without printing it.
  • Disable or redact query-string logging in HTTP clients, reverse proxies, application logs, tracing systems, monitoring platforms, and error reports.
  • Ensure diagnostic output and command history do not retain the request URL.
  • Restrict log access according to least privilege and apply short retention periods.
  • Use dedicated accounts and revocable sessions, rotate the session after sensitive operations, and immediately revoke it if accidental logging occurs.
  • Add an explicit warning that HTTPS alone does not prevent local, proxy-side, or server-side URL disclosure.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (85)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
88% confidence
Finding

The documentation includes a destructive delete endpoint that takes a directly supplied rule identifier, with no mention of confirmation, ownership validation, or safeguards against unintended invocation. In an agent setting, this can enable parameter abuse where a model or caller deletes rules using arbitrary IDs, causing unauthorized state changes or denial of monitoring.

Content

Scanner excerpt · references/webhook-stream-endpoints.md (reported line 33)May include surrounding context.

text
Body: `rule_id` (required), `tag` (required), `value` (required), `interval_seconds` (required), `is_effect` (optional, integer: 0=inactive, 1=active)

**Delete Filter Rule** `DELETE /oapi/tweet_filter/delete_rule`
```bash
curl -s -X DELETE "https://api.twitterapi.io/oapi/tweet_filter/delete_rule" \
  -H "X-API-Key: $TWITTERAPI_IO_KEY" \

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The README prominently advertises write-capable actions such as posting, liking, retweeting, following, and sending DMs, but it does not warn users that these operations can cause immediate real-world changes to a live Twitter/X account. In an agent-skill context, this increases the risk of unintended or unauthorized external actions because users may treat the skill as informational rather than action-capable.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
81% confidence
Finding

The README states that the skill includes a login flow for write actions and can be dropped into an AI tool's context to make real API calls, implying persistent authenticated capability without discussing token/session handling safeguards. In an agent environment, persistent session material for social-media write actions can be abused to perform unauthorized posts, likes, follows, or DMs if the host context, logs, or downstream tools are compromised.

Content

Scanner excerpt · README.md (reported line 15)May include surrounding context.

md
- Required and optional query parameters for each endpoint
- Request body schemas for all POST endpoints
- Authentication, pricing, rate limits, pagination patterns
- Login flow for write actions (tweet, like, retweet, follow)

Drop it into your AI tool's context and it can start making real Twitter API calls.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 23)May include surrounding context.

bash
mkdir -p ~/.openclaw/workspace/skills/twitterapi-io
curl -o ~/.openclaw/workspace/skills/twitterapi-io/SKILL.md \
  https://raw.githubusercontent.com/dorukardahan/twitterapi-io-skill/main/SKILL.md

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 24)May include surrounding context.

bash
mkdir -p ~/.openclaw/workspace/skills/twitterapi-io
curl -o ~/.openclaw/workspace/skills/twitterapi-io/SKILL.md \
  https://raw.githubusercontent.com/dorukardahan/twitterapi-io-skill/main/SKILL.md

Or install via ClawHub:

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 36)May include surrounding context.

bash
mkdir -p ~/.openclaw/workspace/skills/twitterapi-io
curl -o ~/.openclaw/workspace/skills/twitterapi-io/SKILL.md \
  https://raw.githubusercontent.com/dorukardahan/twitterapi-io-skill/main/SKILL.md

Or install via ClawHub:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The installation and usage guidance tells users to provide an API key and paste the skill into LLM contexts, but it does not warn that credentials, account metadata, prompts, and potentially sensitive Twitter data may be sent to a third-party API and possibly exposed within model/tool logs. This omission is risky because users may unknowingly route privileged account access through external services without understanding the privacy and trust implications.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The description says to use the skill whenever the user wants to read or write Twitter data, which is overly broad and can cause the agent to invoke this external integration for ordinary Twitter-related requests. That expands unnecessary data exposure to a third-party service and increases the chance of unintended network actions, especially because the skill supports authenticated write operations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill advertises posting tweets, likes, retweets, follows, and DMs but does not prominently warn that these are account-impacting external actions. In an agent setting, that omission can lead to users or higher-level orchestrators triggering irreversible or privacy-sensitive actions without sufficiently explicit confirmation boundaries.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The webhook/stream workflow recommends sending tweet notifications to a webhook endpoint without warning that tweet data and metadata will be transmitted to an external destination. This can create privacy, retention, and compliance risks if users configure third-party endpoints without understanding what data leaves the platform and where it is stored.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The skill instructs users to install and run an MCP server via npx -y twitterapi-io-mcp without pinning a specific version or integrity-checked source. This creates a supply-chain risk: future package updates or a compromised npm publisher could cause arbitrary code execution in the user's environment when the skill is followed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The endpoint index advertises numerous state-changing and privacy-sensitive operations, including login, DMs, follows, deletions, profile updates, webhooks, and stream monitoring, but provides no warnings or usage constraints. In an agent context, this increases the chance of unsafe automation, unauthorized account actions, privacy-invasive monitoring, or destructive operations being triggered without clear user awareness.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill metadata says it is for reading and writing Twitter/X data, but the endpoint inventory also exposes webhook-management and user-stream monitoring capabilities. That mismatch can mislead users or downstream agents about the true scope of the skill, causing higher-risk monitoring or subscription actions to be invoked without appropriate scrutiny or consent.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
99% confidence
Finding

This endpoint requires login_cookies to be placed in the GET query string, which exposes authentication material in URL logs, proxies, browser history, referrer-like telemetry, and monitoring systems. Because these cookies can grant account-level access to private DM data, leakage could enable session hijacking and unauthorized access to messages or broader account actions.

Content

Scanner excerpt · references/read-endpoints.md (reported line 182)May include surrounding context.

Get DM History by User ID GET /twitter/get_dm_history_by_user_id

bash
curl -s "https://api.twitterapi.io/twitter/get_dm_history_by_user_id?login_cookies=COOKIE&user_id=USERID" \
  -H "X-API-Key: $TWITTERAPI_IO_KEY"

Params: login_cookies (required), user_id (required), proxy (optional but recommended, residential proxy URL)

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/read-endpoints.md (reported line 7)May include surrounding context.

Get My Account Info GET /oapi/my/info

bash
curl -s "https://api.twitterapi.io/oapi/my/info" \
  -H "X-API-Key: $TWITTERAPI_IO_KEY"

Returns your account info (linked to the API key).

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/read-endpoints.md (reported line 15)May include surrounding context.

Get My Account Info GET /oapi/my/info

bash
curl -s "https://api.twitterapi.io/oapi/my/info" \
  -H "X-API-Key: $TWITTERAPI_IO_KEY"

Returns your account info (linked to the API key).

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/read-endpoints.md (reported line 21)May include surrounding context.

Get My Account Info GET /oapi/my/info

bash
curl -s "https://api.twitterapi.io/oapi/my/info" \
  -H "X-API-Key: $TWITTERAPI_IO_KEY"

Returns your account info (linked to the API key).

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/read-endpoints.md (reported line 30)May include surrounding context.

Get My Account Info GET /oapi/my/info

bash
curl -s "https://api.twitterapi.io/oapi/my/info" \
  -H "X-API-Key: $TWITTERAPI_IO_KEY"

Returns your account info (linked to the API key).

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/read-endpoints.md (reported line 38)May include surrounding context.

Get My Account Info GET /oapi/my/info

bash
curl -s "https://api.twitterapi.io/oapi/my/info" \
  -H "X-API-Key: $TWITTERAPI_IO_KEY"

Returns your account info (linked to the API key).

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/read-endpoints.md (reported line 45)May include surrounding context.

Get My Account Info GET /oapi/my/info

bash
curl -s "https://api.twitterapi.io/oapi/my/info" \
  -H "X-API-Key: $TWITTERAPI_IO_KEY"

Returns your account info (linked to the API key).

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/read-endpoints.md (reported line 52)May include surrounding context.

Get My Account Info GET /oapi/my/info

bash
curl -s "https://api.twitterapi.io/oapi/my/info" \
  -H "X-API-Key: $TWITTERAPI_IO_KEY"

Returns your account info (linked to the API key).

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/read-endpoints.md (reported line 60)May include surrounding context.

Get My Account Info GET /oapi/my/info

bash
curl -s "https://api.twitterapi.io/oapi/my/info" \
  -H "X-API-Key: $TWITTERAPI_IO_KEY"

Returns your account info (linked to the API key).

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/read-endpoints.md (reported line 69)May include surrounding context.

Get My Account Info GET /oapi/my/info

bash
curl -s "https://api.twitterapi.io/oapi/my/info" \
  -H "X-API-Key: $TWITTERAPI_IO_KEY"

Returns your account info (linked to the API key).

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/read-endpoints.md (reported line 76)May include surrounding context.

Get My Account Info GET /oapi/my/info

bash
curl -s "https://api.twitterapi.io/oapi/my/info" \
  -H "X-API-Key: $TWITTERAPI_IO_KEY"

Returns your account info (linked to the API key).

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/read-endpoints.md (reported line 83)May include surrounding context.

Get My Account Info GET /oapi/my/info

bash
curl -s "https://api.twitterapi.io/oapi/my/info" \
  -H "X-API-Key: $TWITTERAPI_IO_KEY"

Returns your account info (linked to the API key).

Static analysis

No suspicious patterns detected.